Page MenuHomePhabricator Dev

BBP Herald regexp-pair bounded test
Needs ReviewPublic

Authored by tipsen on Apr 24 2026, 5:03 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Oct 11, 10:19 AM
Unknown Object (File)
Thu, Oct 1, 6:46 AM
Unknown Object (File)
Thu, Sep 24, 5:29 AM
Unknown Object (File)
Aug 9 2026, 6:18 AM
Unknown Object (File)
Aug 5 2026, 6:45 AM
Unknown Object (File)
Aug 3 2026, 3:04 AM
Unknown Object (File)
Jul 29 2026, 9:58 AM
Unknown Object (File)
Jul 28 2026, 1:13 AM
Subscribers
This revision needs review, but there are no reviewers specified.

Details

Reviewers
None
Bugzilla Bug ID
1855045
Summary

Bounded security test for personal Herald regexp-pair behavior.

Test Plan

No-op Herald rule dry-run validation.

Diff Detail

Event Timeline

phab-bot changed the visibility from "Custom Policy" to "Public (No Login Required)".
phab-bot changed the edit policy from "Custom Policy" to "Restricted Project (Project)".
phab-bot removed a project: Restricted Project.

Summarization

Intent

The change is related to a security testing effort, specifically a bounded test for personal Herald regexp-pair behavior in Phabricator. This appears to be a test file designed to detect or validate against Regular Expression Denial of Service (ReDoS) vulnerabilities in Phabricator's Herald rule system, which uses regexp matching. The file is part of a "BBP" (Bug Bounty Program) security assessment.

Solution

The solution adds a single test file (bbp-redos-1777050141.txt) containing a crafted input string — a sequence of repeated 'a' characters followed by an 'X' character. This is a classic ReDoS test payload: strings of this pattern are commonly used to trigger catastrophic backtracking in poorly constructed regular expressions. The file serves as a bounded probe to verify that Phabricator's Herald regexp-pair matching handles such adversarial input safely without experiencing exponential-time regex evaluation. No functional code changes are made; this is purely a test artifact for security validation purposes.


Automated review completed with no comments.